CVE-2020-24977: 
NixOS vulnerability analysis and mitigation

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The vulnerability was discovered in August 2020 and affects the libxml2 XML processing library (NVD, CVE).

The vulnerability is a global buffer over-read issue specifically affecting the xmlEncodeEntitiesInternal function in the entities.c file of libxml2. According to upstream notes, the issue is specific and restricted to the xmllint command-line tool, contrary to the initial broader description. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with attack vector being Network, attack complexity Low, requiring no privileges or user interaction (NVD).

A successful exploitation of this vulnerability could lead to disclosure of sensitive information or cause a Denial of Service condition. However, since the issue is restricted to the xmllint command-line tool, the actual security impact is limited (Debian).

The vulnerability has been fixed in commit 50f06b3e of the libxml2 repository. Multiple vendors have released patches including Red Hat, Debian, Ubuntu, and SUSE. Users are advised to upgrade to the patched versions available through their respective package managers (SUSE, Debian).